Skip to main content

Policy introduction

A policy is a highly flexible data model that allows IT security teams to create and enforce security controls across the organization. Policies can detect browser activities, apply user-facing safeguards, trigger integrations, and report on events. The most common use cases for policies are:

  • Defining and enforcing security policy
  • Blocking and investigating threats
  • Preventing data loss and unauthorized sharing
  • Auditing and reporting on high-risk activity
  • Forwarding specific events to SIEM and alerting tools

At the core of a policy is a detection that identifies browser activities of interest. Policies are applied to specific users, groups, or browsers through Profiles. Each browser evaluates all policies in its assigned profiles against browser activities in real-time.

How policy evaluation works​

Every browser activity goes through policy evaluation, which consists of five key components:

  1. The Web Browser — The browser with Keep Aware installed handles preliminary parsing, metadata collection, and analysis. It serves as the interface for applying safeguards to user activity. A profile controls which policies are applied to the browser.

  2. Browser Activity — Keep Aware detects and analyzes individual browser activities including: page visits, uploads, downloads, credential use, inputs, copy, paste, extension events, fetch requests, and more.

  3. Detection — Every policy attached to the browser's profile is evaluated for every event. The detection query determines if the activity matches the policy's conditions.

  4. Actions — If the policy's detection matches, follow-on actions are triggered. Actions can include: forwarding to an integration, adding a label, creating a threat event, collecting evidence, and more.

  5. Safeguards — The policy can apply a user-facing response through a safeguard. Safeguards range from a helpful tooltip to a full page block.

Policy categories​

Policies are organized into categories that determine their purpose and available configurations:

Threat protection​

Detect and respond to security threats including phishing, malware, social engineering, and credential theft. This is the default category for most security-focused policies.

Data loss prevention (DLP)​

Prevent sensitive data from leaving the organization. Monitor uploads, downloads, copy/paste actions, and form inputs for sensitive content.

Extension management​

Control browser extensions across the organization. Detect installations, block risky extensions, and enforce extension policies.

Acceptable use​

Enforce organizational browsing policies. Control access to categories of sites, require justification for certain activities, and monitor policy compliance.

Browser control​

Apply technical browser controls such as HTTPS enforcement, permission blocking, session management, and credential reuse prevention. These policies work at the browser level rather than per-activity.

Getting started​

The simplest way to get started is to create a policy from a policy template.

A policy template is a pre-configured policy that detects a specific type of activity. Templates are maintained by Keep Aware and cover common security scenarios.

To create a policy from a template:

  1. Navigate to Policies in the console
  2. Click Create policy
  3. Select Review templates to browse available templates
  4. Choose a template and customize as needed

Policy editor​

When you create or edit a policy, you enter the Policy Editor. The editor is organized into sections:

  • Overview — Name, description, category, priority, and severity
  • Detection — Activity types and query conditions
  • Safeguard — User-facing response configuration
  • Browser Controls — Technical browser-level controls (for Browser Control category)
  • Profiles — Which profiles the policy applies to
  • Integrations — Where to send events and alerts
  • Exceptions — Users, devices, or locations to exclude

Policy overview fields​

High-level information about a policy is configured in the Overview section:

  • Name — Identifies your policy. Displayed in the console and logs.
  • Label — Auto-generated from the name in snake_case. Used for searching and filtering.
  • Description — Internal notes about the policy's purpose.
  • Category — The policy type (Threat Protection, DLP, Extension Management, Acceptable Use, Browser Control, or Custom).
  • Priority — Determines evaluation order when multiple policies match (1-5, where 5 is highest).
  • Severity — Indicates the risk level for reporting and alerting (1-5, where 5 is most severe).

Priority and evaluation order​

When multiple policies match the same event, their priority values determine which safeguard is applied:

  1. Policies are ordered by priority (highest first)
  2. The highest priority policy's safeguard is applied
  3. If a lower priority policy has a more restrictive safeguard, that safeguard may take precedence
  4. Policies marked to suppress will prevent lower priority policies from triggering

Policy components​

Each policy can be configured with the following components:

Detection​

The core of a policy. Specifies what activity to detect using activity types and query conditions. See Detection Configuration for details.

Safeguards​

User-facing responses when a policy triggers. Can be a full page block, modal, tooltip, or card. See Safeguard Configuration for details.

Browser controls​

Technical controls applied at the browser level. Available for Browser Control category policies. See Browser Controls for details.

Profiles​

Determines which users and browsers the policy applies to. See Assignments and Exceptions for details.

Integrations​

Where to send events when the policy triggers. See Integrations and Actions for details.

Exceptions​

Users, devices, or locations excluded from the policy. See Assignments and Exceptions for details.

Table of Contents